Validator bonds, governance and rewards

TOKN 2 uses QBFT with bonded validator selection. Besu reads the actual active validator array from BondedValidators.getValidators() after the published transition block. Consensus votes are equal per validator; token balances do not weight consensus votes. This is bonded QBFT, not Ethereum-style Proof of Stake. The original chain ID, genesis block, keys and transaction history remain.

The network currently has one validator and one controller, with no confirmed independent validators. The administrative replica does not add independence. At least four validators are needed for Byzantine fault tolerance. A bond or another container does not establish separate control. Besu QBFT documentation

What the stake actually does

A validator candidate must register a self-bond of at least 100 TOKN and supply an EIP-712 signature from its validator key authorizing its bond operator. The signature binds validator, operator, nonce, deadline, chain and registry. One operator wallet is bound to one validator identity. Creating many wallets does not prove there are many operators.

The council can admit only a funded, registered, non-exiting candidate. Once admitted, its bond cannot be withdrawn while the validator remains active. The same contract supplies Besu's validator set, executes approved removals and sequesters approved penalties. An unrelated deposit does not create a validator. There is no delegation pool or liquid staking token.

The 100 TOKN minimum is nominal bootstrap admission friction, not a demonstrated monetary attack cost. Concentrated genesis allocations can finance many bonds; admission review and real operator independence remain necessary. Our own 100 TOKN bond was first exercised on an isolated Besu network and then supplied in the signed payable live registry deployment. Inspect the exact transaction, address, current principal and validator set in the staking interface and public receipts.

A revenue-funded reward curve

The escrow deducts an immutable 1% fee from the worker's gross settlement. Refunded client funds have no escrow fee. For a gross worker payment of 100 TOKN, the worker receives 99 and validator rewards receive 1. Received voluntary donations follow the same distribution rule and are not refundable.

Each active validator has weight w(s) = min(s, 1000 TOKN), where s is its self-bond. Each fee deposit credits fee * w(s) / sum(active weights), rounded down to a wei. Rounding dust stays sequestered. An inactive candidate receives nothing. The weight is measured when fees reach the registry; added bonds affect subsequent fee deposits immediately. There is no time-based accrual, backpay, compounding instruction or availability oracle.

The cap makes additional principal above 1000 TOKN stop increasing that validator's reward weight; it remains slashable. It does not prevent identity splitting by a controller admitted under several identities. Governance is responsible for assessing operator control. Equal consensus/governance votes remain separate from reward weights.

There is no new issuance, treasury subsidy or recycling of bond principal. No settlement fees or donations means no new rewards. TOKN promises no APR, APY, exchange value or financial return. At low usage these fees may be far below hosting costs; participation may require voluntary operating support. Ordinary native-transfer gas fees still go to the block producer under the existing chain rules and are separate from the escrow reward pool.

Council decisions and exits

Admission, removal and slashing require an evidence hash, approval from more than two thirds of the current equal-vote validator council, and seven days after approval. Anyone may execute a matured proposal. It expires 21 days after creation. Every execution invalidates all outstanding proposals so old ballots cannot act under a changed council. The contract allows at most 32 active validators, keeping validator selection and reward distribution bounded. There is no contract owner or upgrade key.

With one validator, the bootstrap operator alone controls these decisions. There is no independent council today. The council verifies node readiness, network routes, operator identity and misconduct evidence off chain. Evidence documents must remain available for the seven-day review period. The contract checks the required votes and delay, not the truth of the evidence.

This strict threshold can exceed Besu's block-production quorum. With three validators, two may produce blocks but cannot remove the absent third. With two, one missing validator can halt consensus and governance. Admission is an operational change: verify availability of the entire next set before executing it, plan the path to four independently controlled validators, and monitor the transition. Do not imply that staking alone repairs unavailable quorum.

Removal starts a 28-day exit delay. A never-admitted candidate may request its own 28-day exit. The last active validator cannot be removed, slashed or exit; a functioning replacement must be admitted first. A penalty approved during exit freezes withdrawal until its proposal expires, including beyond the ordinary exit date. Repeated approved proposals can extend the freeze; this is part of the disclosed council trust, not permissionless automatic enforcement.

An approved slash removes an active validator and sequesters the chosen amount of its bond permanently. Slashed tokens are neither minted nor paid to the council; total sequestered value is public. A validator/evidence-hash pair can be penalized only once. The council must use a canonical incident document; rehashing or rewriting the same accusation cannot be detected on chain. There is no automatic double-signing verifier, uptime penalty or in-contract appeal. The seven-day delay permits public review, but the contract does not guarantee that a dishonest council will listen. Full slashing still allows clearing the expired exit and registering a new bond under the same persisted identity.

Consensus controllers can coordinate a client-configuration fork or emergency validator override outside this contract. That cannot be prevented by this single-operator bootstrap and must never be described as trustless recovery.

Operator CLI

Use your existing validator identity; never generate or run a second active validator with the same key. Verify the current release, synchronize a peer, and discuss readiness and admission evidence before locking a bond.

just http-wallet stake status
just http-wallet stake consent validator OPERATOR_ADDRESS DEADLINE_UNIX_SECONDS
just http-wallet stake register operator node-001-register VALIDATOR_ADDRESS DEADLINE SIGNATURE 100
just http-wallet stake add operator node-001-more 100
just http-wallet stake rewards operator node-001-rewards RECIPIENT_ADDRESS

The validator consent authorizes a specific operator and registration only; it does not transmit the node private key. Registration itself is signed by the operator funding the bond. Reuse each action ID on retry.

just http-wallet stake propose council admission-001 0 VALIDATOR_ADDRESS 0 EVIDENCE_HASH
just http-wallet stake vote council admission-001-vote PROPOSAL_ID
just http-wallet stake execute observer admission-001-execute PROPOSAL_ID
just http-wallet stake propose council removal-001 1 VALIDATOR_ADDRESS 0 EVIDENCE_HASH
just http-wallet stake propose council penalty-001 2 VALIDATOR_ADDRESS AMOUNT_TOKN EVIDENCE_HASH
just http-wallet stake request-exit operator node-001-exit
just http-wallet stake withdraw operator node-001-withdraw RECIPIENT_ADDRESS

Lessons adopted without copying entire protocols

Ethereum separates committed capital, validator duties, rewards and accountable exits. TOKN keeps that separation while implementing its own council-based enforcement. It does not copy Ethereum's issuance, inverse-square-root reward schedule, stake-weighted consensus or automated penalty machinery. Ethereum rewards and penalties, staking withdrawals

Solana illustrates that realized rewards and operator viability depend on participation and the reward funding policy. TOKN does not copy inflation or a terminal inflation floor. Fee-only security funding must earn real usage. Solana staking documentation, official disinflation discussion

Polkadot's staking reforms distinguish validator self-bonds, reward budgets, withdrawal delays and responsibility for penalties. TOKN specifies those rules separately and does not inherit its nomination system or security guarantees. Polkadot staking reform timeline